Gestión de Políticas de Grupo en Windows Vista y Windows Server 2008 David Cervigón Luna IT Pro Evangelist david.cervigon@microsoft.com http://blogs.technet.com/davidcervigon

3/24/2017 4:01 PM Agenda Introducción: Cambios en el funcionamiento de las políticas de Grupo Novedades en Windows Vista El nuevo formato de políticas ADMX / ADML El almacén central Novedades en Windows Server 2008 Replicación de Sysvol Herramientas de Administración de GPOs Migración de políticas de Grupo Despliegue de políticas de grupo MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Introducción Funcionamiento de las Políticas de Grupo 3/24/2017 4:01 PM Introducción Funcionamiento de las Políticas de Grupo Problemas más frecuentes con las Politicas de Grupo Resolución de los mensajes que aparecen dispersos en múltiples localizaciones Dificultad para encontrar la política correcta 3) Problemas al forzar las políticas (VPNs, hibernación, etc.) Garantizar la aplicación de las políticas a través de enlaces lentos. Necesidad de habilitar y usar “verbose logging” (userenv.log) Directorio Activo MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Políticas de Grupo con Windows Vista y Windows Server 2008 3/24/2017 4:01 PM Políticas de Grupo con Windows Vista y Windows Server 2008 MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3/24/2017 4:01 PM El formato ADMX / ADML Hoy, los ficheros ADM se agregan siempre a cada GPO, a la carpeta correspondiente debajo de Sysvol. Este contenido es replicado Satura SYSVOL con unas 4MB por GPO Los problemas producidos por diferencias de versiones e idioma son frecuentes En Windows Vista /Windows Server 2008, los ficheros ADMX/ADML reemplazan a los .ADM Son ficheros basados en XML Los ADMX contienen los valores de configuración Los ADML contienen los nombres, comentarios e información correspondientes, y son específicos para cada idioma Es una manera más sencilla y estándar de definir políticas SysVol MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Múltiples GPOs Locales Gestión más granular de la máquina local Las GPOs locales todavía tienen menor precedencia que las políticas de dominio (L-S-D-O) Se procesan en el siguiente orden (menor precedencia primero) Local Policy Object Procesa tanto la política de equipo como la de usuario Admin/Non-Admin LGPOs Excluyentes mutuamente para cualquier usuario (es o no es Admin) Solo procesa la política de usuario Específica de usuario Para cuentas de usuarios locales Sólo procesa la parte de usuario Crear / Administrar LGPOs a través de GPEdit.msc Nueva política en Windows Vista para deshabilitar el procesamiento de LGPOs (solo disponible para equipos que pertenezcan a un dominio) Step-by-Step Guide to Managing Multiple Local Group Policy Objects: http://go.microsoft.com/fwlink/?LinkId=73759

Network Awareness Service Detección de enlaces lentos Antes se basaban en ICMP/PING Ahora utilizan el Network Location Awareness Service (NLA) que no se apoya en ICMP/PING Refresco de políticas Cuando se detecta un DC, NLA le informa a GP de que puede refrescar las políticas Si el refresco no sucedió en el último intervalo, GP las refrescará automáticamente Si en el ultimo intervalo de refresco las políticas si que fueron actualizadas, se espera al siguiente ciclo Cuando el DC no responde, la aplicación de políticas falla y usa el mismo estado que la ultima vez que se aplicaron correctamente Es capaz de detectar el establecimiento de conexiones VPN Suspensión / Hibernación

Cambios necesarios en el Esquema del AD para soporte de Windows Vista 3/24/2017 4:01 PM Cambios necesarios en el Esquema del AD para soporte de Windows Vista Soporte Wireless Configuración de la LAN Modo de seguridad Mixto Permitir y denegar listas de redes Wireless Extensibilidad http://go.microsoft.com/fwlink/?LinkId=70195 Recuperación de claves de Bitlocker Almacenamiento de claves en Directorio Activo http://go.microsoft.com/fwlink/?LinkId=78953 MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Ficheros ADMX / ADML Múltiples Políticas Locales

El Almacén Central Componentes 3/24/2017 4:01 PM MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3/24/2017 4:01 PM Replicación de Sysvol DFS-R reemplaza a FRS para la replicación de Sysvol Compresión Replicación diferencial block-level Planificación Control de Ancho de Banda Es necesario que el Bosque/Dominio esté funcionando en el nivel funcional de “Windows Server 2008” Requiere que todos los DCs sean Windows Server 2008 El paso de FRS a DFS-R no es automático MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Consideraciones sobre el uso de ADMX y el Almacén Central Ni los ADMX ni el almacén central tienen dependencia alguna con Windows Server 2008. Funcionan bien en dominios 2000, 2003 y 2008. Son simplemente ficheros en un directorio Equipos con Windows Vista: Usan los ADMX locales si el Almacén Central no está creado Usan el almacén central si existe e ignoran los ADMX locales Windows Vista consumirá cualquier ADM personalizado que encuentre en una GPO, pero ignorará los ADMs de sistema (system.adm, inetres.adm, wuau.adm, conf.adm, wmplayer.adm) Los ADMX no pueden almacenarse en GPOs individuales, pero se pueden agregar ADMs personalizados a una GPO

Construyendo el Almacén Central 3/24/2017 4:01 PM Construyendo el Almacén Central MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

GPMC en Windows server 2008 Es una “característica” que hay que agregar en el Server Manager

Disponibilidad de Plantillas en Windows Server 2008 3/24/2017 4:01 PM Disponibilidad de Plantillas en Windows Server 2008 Inclusión de prácticas recomendadas o escenarios de uso Contendrán la configuración recomendada de políticas y valores Microsoft ofrecerá algunas plantillas iniciales basadas en escenarios Cualquiera puede crear y compartir nuevas plantillas Crear nuevas GPOs basadas en una plantilla La GPMC ofrecerá soporte a la administración de plantillas MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Nuevas funcionalidades en Windows Server 2008 3/24/2017 4:01 PM Nuevas funcionalidades en Windows Server 2008 Comentarios Habilitados por GPO y por valores específicos de políticas particulares Búsquedas / Filtrado: Localizar configuraciones basadas en: Búsqueda de texto en el títulos, explicación y comentarios Plataformas y aplicaciones en las que están soportadas Manejadas (Configuraciones especificadas con valor = TRUE) Configuradas (Habilitadas o deshabilitadas) Los resultados de la búsqueda es una vista filtrada de GPedit MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Filtros, Comentarios y Plantillas iniciales en Windows Server 2008 3/24/2017 4:01 PM Filtros, Comentarios y Plantillas iniciales en Windows Server 2008 © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Herramientas de Administración de GPOs ¿Que sucede si utilizo solamente las versiones de Vista y Windows server 2008 de las herramientas GPMC y GPOE? Pueden administrarse políticas de Windows Vista y Windows Server 2008 Pueden seguirse administrando políticas de Windows 2000 y Windows XP ¿Que sucede si se utilizan las antiguas versiones de las herramientas GPMC y GPOE? NO se pueden administrar políticas de Windows Vista y Windows Server 2008 Managing Group Policy ADMX Files Step-by-Step Guide

3/24/2017 4:01 PM Impacto de la modificación de GPOs usando las herramientas de administración anteriores a Windows Vista / Windows Server 2008 MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Migración de Plantillas ADMX Migrator 3/24/2017 4:01 PM Migración de Plantillas ADMX Migrator ADMX Migrator el una herramienta que convierte plantillas existentes en formato ADM al nuevo formato ADMX Ofrece Interfaz Gráfica para crear y editar Plantillas Administrativas Pueden seleccionarse varios ficheros ADM para su conversión Disponibilidad de ADMX Migrator: http://go.microsoft.com/fwlink/?LinkId=77409 MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

ADMX Migrator 3/24/2017 4:01 PM MICROSOFT CONFIDENTIAL © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Diagnósticos de Políticas de Grupo Nuevos diagnósticos basados en Event System 6.0 Dos nuevos Logs: “Windows Log” “Applications and Services Log” Los sucesos administrativos son creados en el Log del sistema con Origen “Group Policy” Applications and Services Log: Almacena los sucesos operativos. Reemplaza al Userenv.log Nuevas vistas del Visor de Sucesos para informes, filtrado y construcción de vistas personalizadas. Consolidación de sucesos usando “subscripciones” Pueden asociarse acciones a sucesos, como lanzar aplicaciones, scripts, correos, etc. Visor de sucesos integrado con el planificador de tareas Referencia: Troubleshooting Group Policy Using Event Logs

Diagnóstico de Políticas de Grupo

Recursos Link to Group Policy TechNet page http://www.microsoft.com/technet/grouppolicy Group Policy Wiki http://grouppolicy.editme.com Group Policy Team Blog http://blogs.technet.com/grouppolicy Deploying Group Policy Using Windows Vista http://go.microsoft.com/fwlink/?LinkId=77080 Group Policy Settings Reference Windows Vista http://go.microsoft.com/fwlink/?LinkId=54020 Step-by-Step Guide to Managing Multiple Local Group Policy Objects http://go.microsoft.com/fwlink/?LinkId=73434 How to troubleshoot Group Policy using Event logs http://go.microsoft.com/fwlink/?LinkId=74139

Recursos TechNet TechCenter de Windows Server 2008 http://www.microsoft.com/spain/technet/prodtechnol/windowsserver/2008/default.mspx Próximos webcasts en vivo http://www.microsoft.com/spain/technet/jornadas/default.mspx Webcasts grabados sobre Windows Server http://www.microsoft.com/spain/technet/jornadas/webcasts/webcasts_ant.aspx?id=1 Webcasts grabados otras tecnologías Microsoft http://www.microsoft.com/spain/technet/jornadas/webcasts/webcasts_ant.aspx Foros técnicos http://forums.microsoft.com/technet-es/default.aspx?siteid=30

Recursos TechNet Registrarse a la newsletter TechNet Flash http://www.microsoft.com/spain/technet/boletines/default.mspx Obtenga una Suscripción TechNet Plus http://technet.microsoft.com/es-es/subscriptions/default.aspx

El Rostro de Windows Server está cambiando. Descúbrelo en www.microsoft.es/rostros

Preguntas David Cervigón Luna IT Pro Evangelist david.cervigon@microsoft.com http://blogs.technet.com/davidcervigon